CVE-2026-63030

Name of the Vulnerable Software and Affected Versions WordPress versions 6.9.0 through 6.9.4 WordPress versions 7.0.0 through 7.0.1

Description A route confusion issue in the REST API batch endpoint, combined with a SQL injection in the WP Query class, allows a remote attacker to bypass security restrictions. The flaw exists because the author not in parameter in WP Query is not properly protected against SQL structure manipulation. Additionally, a desynchronization occurs within the get items() function between the permission check array, the allowed endpoints list, and the execution array. This combination enables an attacker to perform SQL injection and achieve remote code execution (RCE), potentially leading to unauthorized access to confidential information.

Recommendations Update WordPress versions 6.9.x to 6.9.5. Update WordPress versions 7.0.x to 7.0.2.